Chapter 24 - Model Checking

Abstract

Model checking is an automatic technique for verifying correctness properties of safety-critical reactive systems. This method has been successfully applied to find subtle errors in complex industrial designs such as sequential circuits, communication protocols, and digital controllers. It is expected that besides classical quality assurance measures such as static analysis and testing, model checking will become a standard procedure in the design of reactive systems. A reactive system consists of several components which are designed to interact with one another and with the system's environment. In contrast to functional (or transformational) systems, in which the semantics is given as a function from input to output values, a reactive system is specified by its temporal properties. A (temporal) property is a set of desired behaviors in time; the system satisfies the property if each execution of the system belongs to this set. From a logical viewpoint, the system is described by a semantical (Kripke-) model, and a property is described by a logical formula. Arguing about system correctness, therefore, amounts to determining the truth of formulas in models.